Adds confine: "root" support to scoped worker catalogs, keeping a read-only worker session inside its own checkout even after an AFT restart or catalog epoch rebind. Previously a worker catalog could only request remote execution routing; now it can opt into a root-only filesystem surface.
Confined sessions offer only read, grep, glob, and aft_outline; all other tools are refused with tool_not_offered_confined.
Paths outside the checkout are refused with path_outside_confined_root without permission prompts, regardless of grants or owned bash outputs.
Grep and glob bypass the trigram index and use bounded filesystem walks so no results leak outside the root; replies disclose the fallback.
Symlinks pointing outside the root are not followed, including ignore-file symlinks and implicit Rust module include probes.
Confinement is monotonic: later catalog updates or epoch re-fetches cannot remove it; malformed saved policies fail closed.
Existing in-root credential and deny floors still apply.
Confidence Score: 5/5
The PR appears safe to merge; both previous findings are fixed and no new blocking issue was found.
Summary
Adds confine: "root" for scoped workers, with four read-only tools and checkout-only paths.
Scoped worker catalogs can save a root-only read fence.
Read tools refuse paths outside the worker's checkout.
Confined searches walk only the worker's checkout.
Diagram
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Worker catalog] --> B[Save confinement across epochs]
B --> C[Tool call]
C --> D{Read-only tool?}
D -->|No| E[Refuse tool]
D -->|Yes| F{Path inside checkout?}
F -->|No| G[Refuse path]
F -->|Yes| H[Read or walk checkout]
